Client-side encryption with KMS-managed keys (CSE-KMS)

This diagram shows the six-step encryption process when using CSE-KMS:

Let's understand the process:

1. The client will use an AWS SDK and, in this example, the Java client, to request data keys from KMS using a specified CMK.
2. Using the CMK selected in step 1, KMS will then generate two data keys: a plaintext data key and a cipher blob of the first key.
3. KMS will then send these keys back to the requesting client.
4. The client will perform the encryption against the object data with the plaintext version of the data key and then store the resulting encrypted object.
5. The client then uploads the encrypted object data and the cipher blob version of the key created by KMS to S3.
6. The final stage involves the cipher blob key being stored as metadata against the encrypted object, maintaining a linked association.

This diagram shows the six-step decryption process when using CSE-KMS:

Let's understand the process:

1. A user...